Security test (software)

from Wikipedia, the free encyclopedia

Security tests are software tests that test the security of software . They are a way of increasing information security . The tests can begin as soon as the first line of code has been written so that errors can be detected as early as possible.

particularities

Security tests have a different question than most of the other, general tests, because they are intended to provide evidence that software does not contain functions that it should not contain. Therefore, security tests are mostly so-called negative tests . Furthermore, security tests should provide evidence that there are no unsafe side effects in a program, because a single error is enough to compromise the entire program. The formulation of a security test is usually problematic because the patterns of the vulnerabilities cannot be defined precisely enough. However, security tests can never prove that software is one hundred percent secure.

target

The aim of security tests is to find security-critical vulnerabilities in programs. In this way, an attempt is made to ensure the absence of vulnerabilities in software. It is important that the tests extend over the entire program because, as mentioned above, a single error is sufficient to compromise the entire program.

Programming error

Security tests are designed to find all bugs within a program. Most of these safety-critical errors can be traced back to a few causes. The most common cause are programming errors . There are various schemes for categorizing these programming errors in order to clearly separate the individual errors from one another. The most frequently mentioned categories are the following:

As part of the Open Web Application Security Project (OWASP), an application ( WebGoat ) was developed that helps the user to understand and understand the various programming errors. This application is therefore also a good starting point for developing security tests.

Tools

The tools listed below are mostly safety test tools. Some of the tools are open source .

See also

literature

  • Michael Howard, David LeBlanc: Writing secure code. Practical strategies and proven techniques for building secure applications in a networked world. 2nd edition. Microsoft Press, Redmond, WA 2003, ISBN 0-7356-1722-8

Web links